List Incidents - BlinkOps Documentation

List and filter incidents created within a specified time range. Note: The response includes a nextStartTime value. To retrieve incidents beyond the Limit, run this action again using that value as the Start Time.

External DocumentationTo learn more, visit the Skyhigh Security documentation.

Basic Parameters

Parameter	Description
Actor IDs	A comma-separated list of user identifiers to filter incidents by.
Categories	A JSON array of incident categories to filter by. See the Incident Criteria documentation for the full schema. For example: `[ { “incidentType”: “Threat” }, { “incidentType”: “Alert”, “category”: “Policy” } ]`
End Time	The end of the time range to retrieve incidents from.
Fields	A JSON object of fields to filter by For example: `{ “policyName”: [“PII”, “Encrypted files”] }`
Historical User Risk Score	Select the historical user risk score to filter sanctioned DLP incidents by.
Limit	The maximum number of incidents to return. Values can range from `1` to `500`.
Product	Select the product type to filter incidents by.
Service Names	A comma-separated list of cloud service names to filter incidents by.
Start Time	The beginning of the time range to retrieve incidents from.

Advanced Parameters

Parameter	Description
Additional Parameters	A JSON object for additional body parameters. Values specified in this parameter will override equivalent parameters. For example: `{ “first_key”: 12345, “second_key”: “some_value” }` The object must follow the vendor’s structure as defined in the API documentation.

Example Output

{
	"incidents": [
		{
			"activityNames": [],
			"actorId": "test_mitre_robot_0_1598664766_87@shn.com",
			"actorIdType": "USER",
			"incidentGroup": "Threat.Compromised Accounts.Land Expand Exfiltrate",
			"incidentGroupId": null,
			"incidentId": "THR-51938",
			"incidentRiskScore": 10.0,
			"incidentRiskSeverity": "high",
			"information": {
				"anomalyCount": 4,
				"anomalyIds": "",
				"category": "Compromised Accounts",
				"device": {
					"ip": "0.0.0.0"
				},
				"mitreTactic": [
					"Persistence",
					"Exfiltration",
					"Initial Access",
					"Collection"
				],
				"mitreTechnique": [
					"Email Collection",
					"Share Data from Cloud Account",
					"Valid Accounts",
					"Account Manipulation"
				],
				"userAttributes": {}
			},
			"instanceId": null,
			"instanceName": null,
			"responses": [],
			"serviceNames": [
				"Office365",
				"Office365",
				"OneDrive",
				"Office365",
				"AzureAD",
				"Exchange Online"
			],
			"significantlyUpdatedAt": "2020-09-12T23:43:49.314Z",
			"status": "opened",
			"timeCreated": "2020-09-12T23:39:48.824Z",
			"timeModified": "2020-09-12T23:43:49.314Z"
		}
	],
	"responseInfo": {
		"nextStartTime": "2020-09-12T23:43:49.314Z"
	}
}